October 1998 - Test - lists.nanog.org

Re: HACKER's IRC network, smurf configs, etc etc
by Christopher Neill 14 Oct '98

14 Oct '98

On Wed, Oct 14, 1998 at 06:31:00PM +0400, Alex P. Rudnev wrote: > Christopher. > > I know it. But (1) surely 90% of russion hackers do not read NANOG, (2) I > need to scare those of hackers who did not stop their attempts to break > the whole world, and (3) I need some help from the USA's sys admins (and > Iv got a few important messages already). > > My idea (successfulll last case) is not to close the backdoors hacker > built over the whole world, but to cause him of using this backdoors and > the servers he used to work through. I was silent at the first stage > while the hacker was active in my mouse trap. Now we have provided some > noice here, and I am not sure if it's bad idea to provide more noice over > the world. > > Through you are right - to get ip address was the bad idea. > And I think this was different people who (1) installed IRC network and > (2) snifffed school network... > > No doubt I have not idea to discuss this in open forum anymore.. But to > get some attraction... why not. > instinct tells me that the hackers are from north america. its just that alot of european educational institutions are easy targets, and are attractive because you are less likely to get into trouble to hacking a .ru server.

1 0

HACKER's IRC network, smurf configs, etc etc
by Alex P. Rudnev 14 Oct '98

14 Oct '98

Hi. (Sorry, I had not time to read NANOG forum for some time). As the result of my anti-hacker;'s tracing, I found one place where (may be one, may be a lot) hackers are playing at. This place include: IRCD daemon including into the IRC hacker's network; SMURF program and config files for it; DNS vulen. checker (boft, I am not sure what's it exactly), SNIFFER logs TELNETD daemon for the port 2001 (do you look TCP sessions to your port 2001? This is the hackers, no doubt) backdoor in login It's not difficult to close this host and inform it's owners (through it's school-server and I am not sure if they did not contact hackers themself) but it's not the way to decrease hacker's activity. The best way is to listen to their IRCD daemons, to trace where they are coming from, and where they are getting their tools from and (mainly) where they (or he, I do not know exactly) they store their information. If someone who are familiar with IRC and LINUX and who live in USA (not far from the network '209.180.204/24') is tired from the SMURF attacks and (better) who know some oficial ways to investigate this accident (remember, we know about this place and have back-door account there; they do not know it) want to investigate this incident and fight against this particular hacker or hackers group, welcome... The accident my investigation was started from was BO activity here in Russia, next step was to found the sniffer installed by the hacker at remote 'WWW' server hosted by our customer and look into this file - a lot of interesting about the hacker himself was found there. Step by step... but I never so IRC hacker's server and their IRC network and a lot of this different tools at the same place... But this place is in USA... Once again... it's easy to write a message "Dear system admin. Your system is infected and have been used by hacker for the smurf attack. In addition, all your local paswords are (no doubt) sniffed in.". The result - hacker had 100 backdoors, now he have 99 backdoors; next day he'll open one more... The better is to trace him. This particular server seems to be school-server and does not hold important information.. may be it's good place for someone to start from. But how to do it better in case of USA... I do not know. Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)

2 1

Re: IGPs in use
by Sean M. Doran 14 Oct '98

14 Oct '98

Alex Bligh wrote: | No argument with the principles here but why do you need to redistribute | connected interfaces into your IGP *and* into iBGP? Overkill, surely? This threw me too, actually. It's just wording. "backbone connected interfaces" means "interior interfaces on which you run your IGP". For example: int POS1/0/0 description connection to another backbone location ip address foo bar isis circuit-type level-2-only isis metric 1 level-2 which I think is what Jared means. The terminology to explain the difference between that and actually putting a prefix into your IGP is a bit dense, so a shortcut probably was a reasonable idea. --:) Sean.

1 0

Re: IGPs in use
by Danny McPherson 14 Oct '98

14 Oct '98

> This behavior is easily modified with route reflectors and/or confederations. Although any other introduction of routing hierarchy is into the routing domain should be, well .. even more interesting. As Ben Black so eloquently noted earlier in the thread, "just because BGP is your hammer doesn't mean every problem is a nail". -danny

2 1

Re: IGPs in use
by Danny McPherson 14 Oct '98

14 Oct '98

> How does this affect the hierarchy of the network since all iBGP speakers > must be fully meshed? It'd all have to be flat... Recall the BGP rule: one iBGP speaker mustn't advertise routes to another iBGP speaker if they were learned from a third iBGP speaker. I'd be interested in hearing from anyone that *really* operates a network of more than a few routers and is using iBGP as an IGP .. if you can find the time to send me an email :-) -danny

3 2

[info@webmood.com: I need your kindly help, please!]
by Christopher Neill 14 Oct '98

14 Oct '98

heh, great way to get off the blacklist, lady.. ----- Forwarded message from "E. Bechi - webMood" <info(a)webmood.com> ----- Received: from bird.qual.net (bird.qual.net [209.57.200.4]) by happy.cow.org (8.9.1/8.9-(falcon) b0vine system ready and waiting... m00 m00 said the c0w) with ESMTP id JAA08354 for <noise(a)cow.org>; Mon, 12 Oct 1998 09:24:05 -0400 (EDT) (envelope-from info(a)webmood.com) Received: from nic.iagnet.net (root(a)nic.iagnet.net [209.57.92.2]) by bird.qual.net (8.8.8/8.8.8) with ESMTP id IAA11595 for <noise(a)cow.org>; Mon, 12 Oct 1998 08:27:44 -0400 (EDT) (envelope-from info(a)webmood.com) Received: from users.qual.net (users.qual.net [209.57.253.2]) by nic.iagnet.net (8.9.1/8.9.1) with ESMTP id IAA11446 for <postmaster(a)iagnet.net>; Mon, 12 Oct 1998 08:15:13 -0400 (EDT) Received: from arp.dada.it (arp.dada.it [194.184.248.7]) by users.qual.net (8.9.1/8.9.1) with ESMTP id GAA19159 for <postmaster(a)iagnet.net>; Mon, 12 Oct 1998 06:28:54 -0400 (EDT) Received: from mail.dada.it (mail.dada.it [195.110.96.68]) by arp.dada.it (8.8.5/8.7.3) with SMTP id KAA20027 for <postmaster(a)iagnet.net>; Mon, 12 Oct 1998 10:30:22 +0200 Received: (qmail 17356 invoked from network); 11 Oct 1998 19:47:33 -0000 Received: from dadovago1097.dada.it (HELO bigmuri) (195.110.103.97) by mail.dada.it with SMTP; 11 Oct 1998 19:47:33 -0000 Message-ID: <006401bdf558$52079e00$0500a8c0@bigmuri> From: "E. Bechi - webMood" <info(a)webmood.com> To: <pyro(a)pyrotechnics.com>, <public.com(a)special.abuse.net>, <psychop(a)marmic.com.pl>, <pslaats(a)wbinet.nl>, <prs033(a)postag.de>, <postoffice(a)azteca.com.mx>, <postmaster(a)zoi.com>, <postmaster(a)zoi.co.kr>, <postmaster(a)zocalo.net>, <postmaster(a)zigzag.co.kr>, <postmaster(a)yppi.co.kr>, <postmaster(a)youngha.co.kr>, <postmaster(a)yoomaq.co.kr>, <postmaster(a)yoolim.co.kr>, <postmaster(a)yongsan-hs.seoul.kr>, <postmaster(a)yongsan.seoul.kr>, <postmaster(a)yongjeong-ps.taejon.kr>, <postmaster(a)xxxratedsex.com>, <postmaster(a)xes.com>, <postmaster(a)www.sexzilla.com>, <postmaster(a)www.idci.net>, <postmaster(a)www.departs.co.il>, <postmaster(a)www.beverlyhills-hookers.com>, <postmaster(a)www.a-1.co.jp>, <postmaster(a)wwc.co.kr>, <postmaster(a)wtf.or.kr>, <postmaster(a)worldcom.co.kr>, <postmaster(a)woosinent.co.kr>, <postmaster(a)woorim.co.kr>, <postmaster(a)woonam.co.kr>, <postmaster(a)wonju.ac.kr>, <postmaster(a)wonil.co.kr>, <postmaster(a)wonbuddhism.org>, <postmaster(a)wonbuddhism.or.kr>, <postmaster(a)wit.co.kr>, <postmaster(a)wintec.net>, <postmaster(a)windansea.com>, <postmaster(a)whchang.com>, <postmaster(a)weihenstephan.org>, <postmaster(a)weesung.co.kr>, <postmaster(a)webi.co.kr>, <postmaster(a)web114.net>, <postmaster(a)web114.com>, <postmaster(a)web.net>, <postmaster(a)wazoo.com>, <postmaster(a)waterworks.pusan.kr>, <postmaster(a)wam.umd.edu>, <postmaster(a)w114.net>, <postmaster(a)w114.com>, <postmaster(a)vultures.com>, <postmaster(a)visi-net.com>, <postmaster(a)viper.global-impact.com>, <postmaster(a)vios.co.kr>, <postmaster(a)videosecrets.com>, <postmaster(a)vglq.com>, <postmaster(a)valueweb.net>, <postmaster(a)usr.com>, <postmaster(a)uscom.com>, <postmaster(a)usa1.com>, <postmaster(a)universe.co.kr>, <postmaster(a)unison.co.kr>, <postmaster(a)unisoft.co.kr>, <postmaster(a)uniquest.co.kr>, <postmaster(a)unique.co.kr>, <postmaster(a)unesco.or.kr>, <postmaster(a)umaryland.edu>, <postmaster(a)ulsannet.com>, <postmaster(a)ulsannet.co.kr>, <postmaster(a)ulsan.co.kr>, <postmaster(a)t-shirtrepublic.co.kr>, <postmaster(a)tsb.co.kr>, <postmaster(a)trendmicro.co.kr>, <postmaster(a)transre.com>, <postmaster(a)trail.com>, <postmaster(a)tradebook.com>, <postmaster(a)tpoint.net>, <postmaster(a)tomboy.co.kr>, <postmaster(a)titan.ferris.edu>, <postmaster(a)tip.net>, <postmaster(a)tide.co.kr>, <postmaster(a)thevirtualmarket.com>, <postmaster(a)thegroup.net>, <postmaster(a)tgif.co.kr>, <postmaster(a)textile.co.kr>, <postmaster(a)telysis.com>, <postmaster(a)telenor.net>, <postmaster(a)telemann.com>, <postmaster(a)telemail.net>, <postmaster(a)telekorea.co.kr>, <postmaster(a)telcom-eng.co.kr>, <postmaster(a)telcel.net.ve>, <postmaster(a)tds.co.kr>, <postmaster(a)tdmi.com>, <postmaster(a)tc.co.kr>, <postmaster(a)taijinmedia.com>, <postmaster(a)taijin.com>, <postmaster(a)taechang.co.kr>, <postmaster(a)tacs.co.kr>, <postmaster(a)t3comm.com>, <postmaster(a)system3.com>, <postmaster(a)Symantec.com>, <postmaster(a)sws.co.kr>, <postmaster(a)swlink.net>, <postmaster(a)supus.co.kr>, <postmaster(a)superlink.net>, <postmaster(a)superbrd.co.kr>, <postmaster(a)sunrise.co.kr>, <postmaster(a)sunkwang.com>, <postmaster(a)sungdo.co.kr>, <postmaster(a)sulbong.co.kr>, <postmaster(a)suhryung.co.kr>, <postmaster(a)sudo.co.kr>, <postmaster(a)stryker.co.kr>, <postmaster(a)strutyourstuff.com>, <postmaster(a)stpt.com>, <postmaster(a)starnetusa.net>, <postmaster(a)starlinknet.net>, <postmaster(a)ssys.net>, <postmaster(a)ssc.co.kr>, <postmaster(a)sprint-canada.net>, <postmaster(a)sprint.ca>, <postmaster(a)sports.co.kr>, <postmaster(a)sportnet.co.kr>, <postmaster(a)spain-plus.com>, <postmaster(a)southeast.net>, <postmaster(a)sosglb.com> Subject: I need your kindly help, please! Date: Sun, 11 Oct 1998 21:40:53 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 4.72.3155.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0 Status: O Content-Length: 856 Lines: 36 Good Evening. I've found you at http://www.abuse.net/cgi-bin/list-abuse-addresses I'm the owner of http://www.webmood.com (DNS: 209.95.107.10). Somebody has been used my SMTP server few days ago, so I received an E-mail: My server was listed on http://www.dorkslayers.com/orbs/ I installed PopAuth and now my SMTP Server is not listed in ORBS blocking list. Somebody used my E-mail Alias to spam again by other's SMTP Servers... I've three question, please: 1) How to check if any of my E-mails could be on your bloking list? 2) How to remove any block and how to stop the spam I receive? 3) How to report to you any unsolecited E-mail I often receive? Thnak you indeed and Regards. Emanuela Bechi Murisengo webMood di Emanuela Bechi Murisengo http://www.webmood.com via de Cadolingi, 4/A 50142 Firenze (IT) tel. / fax: +390557876154 ----- End forwarded message -----

4 6

Re: *sigh* NT/netbios over IP over frame
by Dean Anderson 13 Oct '98

13 Oct '98

I think the backhoe operator should be wearing an MS flag teeshirt... Maybe say something about a floating point error calculating the position of the cable... --Dean At 10:02 AM 10/13/98 -0400, Howard C. Berkowitz wrote: >Somewhere on the shirt under development, should the backhoe exhaust be emitting NetBEUI frames? > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: IGPs in use
by Tony Li 13 Oct '98

13 Oct '98

amb(a)gxn.net (Alex Bligh) writes: > > 1) If you put your backbone connected interfaces (loopbacks > > serials, etc.. in your IGP [isis, ospf, whatever]) > > 2) Have a full iBGP mesh doing next-hop-self of the loopback > > interface > > 3) Redistribute statics and connected into your iBGP routing table > > (with route-map, or appropriate filters as necessary that vary by vendor) > > No argument with the principles here but why do you need to redistribute > connected interfaces into your IGP *and* into iBGP? Overkill, surely? In fact, you not only don't need to do so, you want to avoid doing so. This simply pollutes BGP and you'll need to remove it later at the domain border where you're aggregating anyhow. Tony

1 0

Re: IGPs in use
by Megatron 13 Oct '98

13 Oct '98

Ben, I stand corrected sorry for the mistype. you are right about using bgp as Exterior Gateway Protocol but I have used IBGP internaly on my network in the past. You should be able to segment your network into different AS's and do more fun stuff. -Mohamed On Mon, 12 Oct 1998, Ben Black wrote: > I would say BGP is an exterior gateway protocol and using iBGP as an IGP is > unwise. Much like posting to nanog when you have no clue. > > > Ben > > On Mon, Oct 12, 1998 at 04:14:10PM -0400, Megatron wrote: > > > > I would say the most interior Routing Protocol that is out there is BGP. > > It gives a better control of route announcements. > > > > -Megatron > > > > > > On Mon, 12 Oct 1998, Andre' Zehl wrote: > > > > > > > > Is there an overview on what the dominantly used interior routing protocols are percentagewise in large AS backbones (IBGP, OSPF, IGRP, EIGRP, IS-IS, any?). I don't want to start religous wars on what's the best protocol, I'm rather interested if there is an overview available on the facts of protocols used. Is there an "objective" (vendor-independent) feature-based overview on the compared advantages/disadvantages (especially regarding redistribution) of the various protocols that goes with those numbers? > > > > > > Andre' > > > > > > zehl(a)berkom.de > > > >

10 11

Re: *sigh* NT/netbios over IP over frame
by Eric Germann 13 Oct '98

13 Oct '98

email me your questions. I've done this many times before. Eric ekgermann(a)cctec.com ---Raymond Wong wrote: > > > > I swore I'd never do anything like this, but I've been tasked with > establishing NT network connectivity between 2 private networks > over frame relay. I got a pair of 2501s running 11.3, and I've got IP > routing right (all the sparcs are happy). I've got NT/etc machines, running > with NetBIOS bound over the TCP stack. None of the PC people knows > IP well enough to say what they need. Does anyone who has done this > care to provide any hints? a URL to a faq would be fine, though a search > seemed to turn up lots of assumptions that wins is required, which > sounds odd to me. > > I've enabled IP forward udp, and tried setting ip helper to the broadcast > address on the other side... should this work? am I missing an obvious > reason it won't, or better, an obvious way to make it work? I'm not about > to go around and change 400 PCs for this, so a router config would really > be preferable. > > private email replies preferred, of course. > > Ray Wong > > > > _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0